Privacy Policy

Effective date: August 3, 2026 · Last updated: August 3, 2026

This Privacy Policy explains how CMOON PTE. LTD., a company incorporated in Singapore ("Company", "we", "us", "our"), collects, uses, discloses and protects personal data when you use the LazyKiwi websites (including lazykiwi.ai and its subdomains), applications and related services (the "Service"). It should be read together with our Terms of Use.

We comply with the Singapore Personal Data Protection Act 2012 ("PDPA") and, where applicable, other data-protection laws such as the EU/UK General Data Protection Regulation ("GDPR") and U.S. state privacy laws. By using the Service, you acknowledge this Privacy Policy and, where consent is the applicable basis, consent to the collection, use and disclosure of your personal data as described here.

1. Information We Collect

1.1 Information you provide

Account information — email address, name or username, password (stored in hashed form), and profile details you choose to add. If you sign in via a third-party login (e.g., Google), we receive basic profile information from that provider.
Content you upload and create — photos, images, videos, audio, prompts, text and other Inputs you submit, and the Outputs generated for you (together, "User Content"). Uploaded media may include images of faces or other identifiable features; only upload content you have the right to share.
Payment and transaction data — your purchases, subscription plan, and billing history. Payments are handled by third-party payment processors; we do not store your full card number.
Communications — messages you send us (e.g., support emails, feedback, survey responses).

1.2 Information collected automatically

Usage data — features used, generations run, credits spent, pages viewed, referring pages, and interaction timestamps.
Device and log data — IP address, approximate location derived from IP, browser type, operating system, device identifiers, language, and crash/error logs.
Cookies and similar technologies — see Section 6.

2. How We Use Personal Data

To provide the Service — create and manage your account, process your Inputs to generate Outputs (including via third-party AI model providers), store your creations, process payments, and provide support.
To improve and develop the Service — analyze usage, debug, test features, and develop, improve and train the models, effects and features that power the Service, using User Content and usage data. Content that you have deleted will not be used for future training after it is purged from our systems (Section 7).
To keep the Service safe — detect and prevent fraud, abuse, security incidents, policy violations (including automated content-safety screening of Inputs and Outputs) and duplicate free accounts.
To communicate with you — service messages (receipts, renewal and account notices) and, with your consent or as otherwise permitted by law, marketing emails about features and offers (you can unsubscribe at any time via the link in each email).
Advertising and analytics — measure campaigns and, where used, show or measure ads for our own Service through advertising and analytics partners.
Legal purposes — comply with legal obligations, enforce our Terms, and establish, exercise or defend legal claims.

2.1 Legal bases (GDPR)

Where the GDPR applies, we process personal data on these bases: performance of a contract (providing the Service you signed up for); legitimate interests (improving and securing the Service, preventing abuse, marketing our own services) balanced against your rights; consent (where required, e.g., certain cookies or marketing — withdrawable at any time); and legal obligation.

3. How We Share Personal Data

We do not sell your personal data for money. We share personal data only as follows:

AI model and infrastructure providers — your Inputs (and resulting Outputs) are transmitted to and processed by the third-party AI model providers and cloud/hosting providers we use to run generations and operate the Service.
Service providers — payment processors, email/communications tools, customer-support tools, analytics providers and security vendors, who may process data only to provide services to us.
Advertising partners — limited identifiers and event data for measuring and delivering our own advertising, where such tools are used; you can opt out of cookie-based tracking (Section 6) and, where applicable law treats this as "sharing"/targeted advertising, exercise the opt-out rights in Section 9.
Content you make public — if you publish or share a creation to public areas or community/showcase features, it is visible to others and may be featured in our marketing as described in the Terms of Use.
Corporate transactions — in connection with a merger, acquisition, financing, reorganization or sale of assets, personal data may be transferred as part of that transaction.
Legal and safety — to comply with law or legal process, to protect the rights, safety and property of the Company, our users or the public, and to detect and prevent fraud or abuse (including reports to authorities regarding child-safety violations).
With your direction or consent.

4. Third-Party Services

The Service is built on third-party AI models and infrastructure. When your Inputs are processed by a model provider, that processing is performed on our behalf under contractual safeguards where available; however, third-party sites and services you access through links are governed by their own privacy policies, which we do not control and are not responsible for.

5. Security

We use reasonable administrative, technical and organizational safeguards designed to protect personal data, including encryption in transit, access controls and hashed passwords. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

6. Cookies and Analytics

We and our partners use cookies, local storage and similar technologies to keep you signed in, remember preferences, measure how the Service is used, and (where used) measure or deliver advertising for our own Service. You can control cookies through your browser settings; blocking some cookies may affect functionality. Where required by law, we will request consent for non-essential cookies via a cookie banner, and industry opt-out tools (such as your browser's Global Privacy Control signal, where legally recognized) will be honored.

7. Data Retention

Account data is kept while your account is active and for as long as needed for the purposes described in this Policy.
User Content you delete, and content associated with a deleted account, is removed from our active systems within 30 days of deletion, except copies retained in routine backups for a limited period, content you shared publicly, and data we must keep for legal, security or accounting reasons. Deleted content is not used for future model training after purge; improvements already incorporated into models cannot be reversed.
Transaction records are retained as required by tax and accounting law.

When personal data is no longer needed, we delete or anonymize it; anonymized or aggregated data that no longer identifies you may be retained and used without restriction.

8. International Transfers

We are based in Singapore, and our service providers and model providers may be located in other countries (including the United States). Your personal data may therefore be transferred to, stored and processed in countries with data-protection laws different from those of your home jurisdiction. Where required, we use appropriate safeguards for such transfers, such as contractual protections consistent with the PDPA and, for transfers of European personal data, Standard Contractual Clauses or another lawful transfer mechanism.

9. Your Rights and Choices

Subject to applicable law, you may:

Access and correction — request access to, or correction of, personal data we hold about you (PDPA/GDPR/U.S. state laws).
Deletion — delete your creations in the product, or request deletion of your account and personal data.
Portability — request a copy of certain data in a portable format.
Objection and restriction — object to or ask us to restrict certain processing, including processing based on legitimate interests.
Withdraw consent — at any time, without affecting processing already performed (this may limit or end your ability to use parts of the Service).
Marketing opt-out — use the unsubscribe link in any marketing email.
U.S. state rights — depending on your state, you may have rights to know, correct, delete, and to opt out of "sale"/"sharing" of personal information or targeted advertising. We do not sell personal data for money; to opt out of cookie-based sharing for advertising, use the controls in Section 6 or contact us. We do not knowingly process sensitive data for purposes requiring additional consent, and we will not discriminate against you for exercising your rights.
Complaints — lodge a complaint with your local supervisory authority (in Singapore, the Personal Data Protection Commission; in the EU/UK, your data-protection authority). We would appreciate the chance to address your concerns first.

To exercise any right, email cmoonchat@gmail.com from the address linked to your account (or with enough information for us to verify your identity). We respond within the timeframes required by applicable law and may decline requests where an exemption applies.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. Users aged 13–17 may use the Service only with parental consent as described in the Terms of Use. If you believe a child has provided us personal data without appropriate consent, contact us at cmoonchat@gmail.com and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last updated" date, and material changes may be notified by email or in-product notice. Your continued use of the Service after an update constitutes acceptance of the updated Policy to the extent permitted by law.

12. Contact Us

Data controller / organisation responsible: CMOON PTE. LTD. (Singapore) Data Protection Officer / privacy contact: cmoonchat@gmail.com